2013 IDENTITY FRAUD REPORT:

Transcription

1 February 2013

2 A J : Javelin Strategy & Research, a division of Greenwich Associates, provides strategic insights into customer transac ons, increasing sustainable profits for financial ins tu ons, government, payments companies, merchants and other technology providers. A : Alphonse Pascual, Senior Analyst, Security, Risk and Fraud Sarah Miller, Analyst, Security, Risk and Fraud R : Lorie Cur s, Research Associate James Jarzab, Research Specialist Aleia Van Dyke, Analyst Daniel Van Dyke, Research Associate Paul Wangsvick, Research Specialist C : Jim Van Dyke, CEO Mary Monahan, Execu ve Vice President and Research Director P D : February 2013 O Iden ty fraud incidence increased in 2012 for the second consecu ve year, affec ng 5.26% of U.S. adults. This increase was driven by drama c jumps in the two most severe fraud types, new account fraud (NAF) and account takeover fraud (ATF). Javelin s 2013 Iden ty Fraud Report provides a comprehensive analysis of fraud trends in the context of a changing technological and regulatory environment in order to inform consumers, financial ins tu ons, and businesses on the most effec ve means of fraud preven on, detec on, and resolu on. This year, Javelin conducted a thorough explora on of the rela onship between the compromise of personal informa on in a data breach and fraud incidence. This report also expounds current trends in online retail fraud and familiar fraud, and implicates key factors in vic ms suscep bility and responses to fraud Iden fy Fraud Report data was gathered by a survey of a representa ve sample of 5,249 U.S. adults, including 857 consumers who were fraud vic ms in the past six years. This report has been issued as a longitudinal update to the Javelin 2005, 2006, 2007, 2008, 2009, 2010, 2011 and 2012 iden ty fraud reports, and the Federal Trade Commission s 2003 Iden ty The Survey report. P : L : $3,000 Department license $5,500 Enterprise license 82 pages 56 charts/graphs The survey was made possible in part by Ci Group Inc., Intersec ons LLC, and Visa Inc. To preserve the project s independence and objec vity, the sponsors of this project were not involved in the tabula on, analysis, or repor ng of final results. Copyright 2013 Javelin Strategy & Research, a division of Greenwich Associates. All rights reserved. It is protected by copyright and other intellectual property laws. You may display or print the content available for your use only. You may not sell, publish, distribute, re transmit or otherwise provide access to the content of this report. 2

3 M The 2013 Javelin Iden ty Fraud Survey Report provides consumers and businesses an in depth and comprehensive examina on of iden ty fraud in the United States. Its purpose is to help readers understand the causes and incidence rates of iden ty fraud and the success rates of methods used for its preven on, detec on, and resolu on. This report builds on Javelin s annually published Iden ty Fraud Survey Report and the Federal Trade Commission s 2003 Iden ty The Survey Report S D C Javelin s ID fraud survey was historically fielded as a landline survey using computer assisted telephone interviewing (CATI). At the me of the survey s incep on in 2003, landlines provided a rela vely comprehensive coverage of the U.S. popula on. However, with advent of me and technology, landline coverage has been shrinking thus the ID fraud survey has had increasingly less penetra on into the younger, more mobile popula on. Cognizant of this shi, in 2011 Javelin fielded the ID fraud survey through the KnowledgePanel. Javelin con nued to use KnowledgePanel for its 2012 and 2013 ID fraud surveys in order to obtain the most representa ve sample of U.S. adults. KnowledgePanel is the only probability based online panel in the U.S. The panel recruits households with no access to Internet (at the me of recruitment) as well as cell phone only households, through mail recruitment. The panel offers a mix of RDD based recruitment (1999 present) and address based sampling (introduced in 2008 with a full rollout in 2009). The 2013 ID fraud survey was conducted among 5,249 U.S. adults over age 18 on KnowledgePanel; this sample is representa ve of the U.S. census demographics distribu on, recruited from the Knowledge Networks panel. Data collec on took place between September 20 and October 12, Final data was weighted by Knowledge Networks, while Javelin was responsible for data cleaning, processing, and repor ng. Data is weighted using 18+ U.S. Popula on Benchmarks age, gender, race/ethnicity, educa on, census region, and metropolitan status from the most current CPS targets. L T Given the departure from the previous computer assisted telephone interviewing (CATI) through random digit dialing (RDD), Javelin also fielded a parallel CATI survey among 1, adults in 2011 through Opinion Access in order to derive calibra on es mates to trend and update longitudinal data. For all ques ons asked of the en re popula on, data has been calibrated using ra os derived from comparing 2011 CATI vs. web based survey. For other ques ons affec ng only a subset of the popula on, a three year rolling average has been applied to smooth year over year trending data. Copyright 2013 Javelin Strategy & Research, a division of Greenwich Associates. All rights reserved. It is protected by copyright and other intellectual property laws. You may display or print the content available for your use only. You may not sell, publish, distribute, re transmit or otherwise provide access to the content of this report. 3

4 In adherence with best prac ces, in 2011 Javelin also moved from bracketed dollar amount calcula ons to true open end numerical dollar calcula ons. On con nuous variables captured from numerical open ended items, extreme outliers were iden fied using a standard rule of approximately two standard devia ons above the mean to retain consistency year over year. These extreme outliers were replaced with mean values to minimize their dispropor onate impact on final weighted es mates. Where responses pertained to a range in value (e.g., one day to less than one week ), the midpoint of the range, rounded up to the nearest whole unit, was used to calculate the median or mean value. For example: If the response selected for number of days to detec on was one day to less than one week, the assigned value would be the median of one day and seven days, inclusive, or four days. To ensure consistency in comparing year to year changes, historical figures for average fraud amounts have been adjusted for infla on using the Consumer Price Index. Due to rounding errors, the percentages on graphs may add up to 100% plus or minus 1%. C F FTC With one excep on, this report con nues to classify fraud within the three categories originally defined by the FTC in For 2005 and beyond, debit card fraud has been recategorized as exis ng card account fraud 50 instead of exis ng non card account fraud. 51 Javelin believes this change reflects a more accurate representa on of debit card fraud, because much of its means of compromise, fraudulent use, and detec on methods parallel those of credit cards. The categories of fraud are listed below from least to most serious: Exis ng card account: This category includes both the account numbers and/or the actual card for exis ng credit and cardlinked debit accounts. Prepaid cards were added for 2007 and subsequently removed due to extremely low incidence. Exis ng non card account: This category includes exis ng checking and savings accounts, and exis ng loans, insurance, telephone, and u li es accounts. New account and other fraud: This category includes new accounts or loans for commi ng the, fraud, or other crimes using the vic m's personal informa on. Many vic ms experience iden ty fraud within more than one of these categories. In repor ng the overall incidence rates of the three categories or types of accounts, the vic ms of crimes to more than one type of account are categorized based on the most serious (as designated by the FTC) problem reported. Thus, vic ms who reported that new accounts had been opened using their informa on and also that their exis ng credit cards had been misused would be placed in the new account and other fraud classifica on, not in the exis ng card account classifica on. This categoriza on is applicable only for repor ng the rates of the three types of fraud. Copyright 2013 Javelin Strategy & Research, a division of Greenwich Associates. All rights reserved. It is protected by copyright and other intellectual property laws. You may display or print the content available for your use only. You may not sell, publish, distribute, re transmit or otherwise provide access to the content of this report. 4

5 D F FTC 2003 M R When the report cites vic ms average financial damages or resolu on mes in dollars or hours, the en re amount of damages or losses is placed into every type of fraud the vic ms suffered. For example, for a vic m who reports that a total of $100 is obtained for both new account and other fraud category and exis ng card account, the $100 is counted in both categories. This method of repor ng costs by types of fraud will not change the overall total costs of fraud across all three categories, but the average in dollars or me associated in the three types of fraud should not be summed because the result will be overlapping amounts. S Q The set of ques ons and underlying methodology used for this report were iden cal to or highly similar to those in the 2011, 2010, 2009, 2008, 2007, 2006, 2005, 2004, and 2003 surveys. Some structural adjustments were made in 2011 to adapt CATI based ques ons to web based ques ons. All changes were made under the purview of experienced methodologists. Therefore, Javelin con nues to provide longitudinal trends on various subjects, such as incidence rates and detec on methods. In addi on, Javelin added a number of discreet new ques ons in 2012 to further explore the significance of past responses as well as to iden fy new trends around emerging technologies. In par cular, Javelin sought to gain a be er understanding of consumer behaviors regarding organiza ons contacted a er fraud incidence. M E The ID fraud report es mates key fraud metrics for the current year using a base of consumers experiencing iden ty fraud in the past six years. 52 Other behaviors are reported based on data from all iden ty fraud vic ms in the survey (i.e., based on fraud vic ms experiencing fraud up to six years ago) as well as total respondents, where applicable. For ques ons answered by all 5,249 respondents, the maximum margin of sampling error is +/ 1.35 percentage points at the 95% confidence level. For ques ons answered by all 857 iden ty fraud vic ms, the maximum margin of sampling error is +/ 3.35 percentage points at the 95% confidence level. S O The project was made possible in part by Ci Group Inc., Intersec ons LLC and Visa Inc. To preserve the project s independence and objec vity, the sponsors of this project were not involved in the tabula on, analysis, or repor ng of final results. Copyright 2013 Javelin Strategy & Research, a division of Greenwich Associates. All rights reserved. It is protected by copyright and other intellectual property laws. You may display or print the content available for your use only. You may not sell, publish, distribute, re transmit or otherwise provide access to the content of this report. 5

6 Table of Contents OVERVIEW... 6 INTRODUCTION... 7 Execu ve Summary... 7 Major Findings... 7 Recommenda ons Consumer Recommenda ons for Preven on, Detec on and Resolu on of Iden ty Fraud Recommenda ons for Financial Ins tu ons Recommenda ons for Merchants QUICK REFERENCE GUIDE FRAUD TYPES New Account Fraud Compromising Iden es Fraudsters Prefer New Card Accounts Exis ng Account Fraud Exis ng Card Fraud Payment Card Data Targeted Through Mul ple Vectors Addressing Fraud A empts The Effect of EMV Exis ng Non Card Fraud Account Takeover Accessing Exis ng Accounts Accounts Targeted and the Effect on Consumers Familiar Fraud Despite Changes in Fraud Trends, Familiar Fraud Pa erns Remain Constant Mo va on and Opportunity One Stop Shopping: Access to PII and the Severity of Familiar Fraud PREVENTION Data Breaches: Precursors to Fraud Online Retail Fraud Mobile Consumers Are Vulnerable Targets Social Media Risky Prac ces on Social Networking DETECTION Methods of Detec on Means of Detec on by Fraud Type

7 Table of Contents Means of Detec on Among Exis ng Debit and Credit Card Fraud Vic ms Effect of Common Fraud Detec on Types on FI Fraud Vic m Reten on Length of Fraudulent Ac vity Before Detec on by Detec on Methods Detec ng Familiar Fraud: Perpetrators Represent Camouflaged Threat RESOLUTION Fraud Resolu on Rates Reach All Time High Resolu on by Fraud Type Exis ng Card Fraud Resolu on Is Quicker Because the Process Is Streamlined Exis ng Non Card Fraud Resolu on New Account Fraud Resolu on Account Takeover Fraud Resolu on Severity of Fraud and Resolu on Ac ons Lower Income Consumers Are More Severely Affected by Fraud Low Income Consumers Know the Perpetrators and Take Legal Ac on Fraud Severity and Responses to Fraud Demographic Determinants of Resolu on Ac on Consumer Responses to Fraud Depend on Age APPENDIX METHODOLOGY Survey Data Collec on Longitudinal Trending Categorizing Fraud by FTC methodology Devia on From FTC and 2003 Methodology and Repor ng Survey Ques onnaire Margin of Error Contribu ng Organiza ons GLOSSARY RELATED RESEARCH COMPANIES MENTIONED

8 Table of Figures Figure 1: Overall Iden ty Fraud Incidence Rate and Total Fraud Amount by Year... 7 Figure 2: Breakdown of Iden ty Crime Types Figure 3: Overall Measures of the Impact of Iden ty Fraud, Figure 4: Iden ty Fraud Overview: Exis ng Account Fraud Figure 5: Iden ty Fraud Overview: Exis ng Card Fraud Figure 6: Iden ty Fraud Overview: Exis ng Non Card Fraud Figure 7: Iden ty Fraud Overview: New Account Fraud Figure 8: Iden ty Fraud Overview: Account Takeover Fraud Figure 9: New Account Fraud Incidence and Total Fraud Amount by Year Figure 10: Types of New Fraudulent Accounts Opened Figure 11: Exis ng Account Fraud Incidence and Total Fraud Amount by Year Figure 12: Exis ng Card Fraud Incidence and Total Fraud Amount by Year Figure 13: Type of Exis ng Card Misused by Age Figure 14: Type of Personal Informa on Compromised in a Data Breach Figure 15: Road Map for EMV Migra on And Shi ing Liability Figure 16: Exis ng Non Card Fraud Incidence and Total Fraud Amount by Year Figure 17: Consumer Out of Pocket Costs As a Percent of Fraud Losses Figure 18: Account Takeover Fraud Incidence and Total Fraud Amount by Year Figure 19: Informa on Changed on Accounts Taken Over Figure 20: Recent Use of Security So ware Figure 21: Types of Accounts Taken Over Figure 22: Type of Card Account Misused Among Account Takeover Vic ms and All Fraud Vic ms Figure 23: Key Fraud Metrics among Familiar Fraud and Non Familiar Fraud Vic ms Figure 24: Personal Acquaintance With the Perpetrator by Annual Household Income Figure 25: Severity of Effec ve Fraud by Familiar Fraud Vic ms, All Fraud Vic ms Figure 26: Type of PII Compromised Among Familiar Fraud Vic ms, All Fraud Vic ms Figure 27: Fraud Incidence by Data Breach Vic ms, Non Data Breach Vic ms and All Fraud Vic ms Figure 28: Incidence of Fraud Types by Type of Informa on Breached Figure 29: Means of Misuse of Fraud Vic ms Informa on Figure 30: Online Retail Fraud Incidence vs. POS Fraud Incidence Figure 31: Type of Exis ng Card Misused for Fraudulent Online vs. In Person Purchases Figure 32: Mobile Consumers Percep ons of the Riskiness of Behaviors Figure 33: How Recently Mobile Consumers Have Downloaded Apps to their Mobile Device Figure 34: Fraud Incidence by Ownership of Tech Products Figure 35: Incidence Rate by Social Networking Ac vity,

9 Table of Figures Figure 36: Means of Fraud Detec on by Fraud Type Figure 37: Means of Fraud Detec on by Credit and Debit Card Vic ms Figure 38: Fraud Vic ms Who Switched Their FI or Credit Card Provider by Detec on Method Figure 39: Mean Detec on Time by Fraud Detec on Method Figure 40: Detec on Times for All Fraud Vic ms vs. Familiar Fraud Vic ms Figure 41: Means of Discovery of Fraud by All Fraud Vic ms vs. Familiar Fraud Vic ms Figure 42: Percent of Fraud Vic ms Who Have Completely Resolved Their Fraud Figure 43: Percent of Vic ms Who Have Resolved Their Fraud by Fraud Type, 2011 and Figure 44: Number of Organiza ons Contacted for Assistance by Fraud Type Figure 45: Resolu on Time by Fraud Type Figure 46: Organiza ons Contacted by Fraud Type Figure 47: Severity of Effect of Fraud by Fraud Type Figure 48: Fraud Amounts and Consumer Costs As a Percent of Annual Household Income Figure 49: Severity of Effect of Fraud by Annual Household Income Figure 50: Agencies Contacted by Familiar Fraud Vic ms and All Fraud Vic ms Figure 51: Legal Ac ons Taken by Familiar Fraud Vic ms and All Fraud Vic ms Figure 52: Responses to Fraud by Fraud Amount and Resolu on Hours Figure 53: Organiza ons Contacted by Severity of Fraud Figure 54: Fraud Vic ms Responses to Fraud by Age Figure 55: Vic ms Ac ons as a Result of Fraud by Year Figure 56: Types of Merchants Fraud Vic ms Avoid

10 E S The incidence of iden ty fraud in the U.S. con nues to rise, rebounding from a sharp decline between 2009 (6.0%) and 2010 (4.35%), and increasing further from 4.9% in 2011 to 5.26% in Iden ty fraud affected 12.6 million consumers in 2012, and at least half did not suffer any out of pocket costs (median cost to consumers of $0) nor did they spend much me resolving these cases (median resolu on me of three hours). That is not to say that all cases of fraud have equally limited nega ve effects the mean cost to consumers as a result of fraud actually increased from $354 in 2011 to $365 in 2012, with the bulk of the fraud costs being borne by financial ins tu ons, merchants, and other businesses. The mean resolu on me remains unchanged at 12 hours. On a posi ve note, consumer informa on is being misused SAMPLE PAGE for the shortest period of me (48 days), and more of these cases are being resolved (92% resolu on rate) than at any me in the past seven years. Major Findings New Account Fraud Increasingly Threatens Consumers and Businesses Having increased by 50%, from 0.82% of all adults in 2011 to 1.22% in 2012, NAF poses a growing threat to consumer iden es and private industry s bo om line especially as the total fraud loss has doubled from 2011, to $9.8 billion. Monitoring of credit reports can help detect many of these cases, as 57% of NAF cases involved the establishment of new general use and store branded credit cards. Iden ty Fraud Rises for Second Consecu ve Year, Affec ng 5.26% of Consumers and Cos ng $20.9 Billion Figure 1: Overall Iden ty Fraud Incidence Rate and Total Fraud Amount by Year Billions in U.S. Dollars $35 $30 $25 $20 $15 $10 $ % $ % $ % $ % $ % $ %* $ % $ % 10% 9% 8% 7% 6% 5% 4% 3% Percent of consumers $5 2% 1% $ *Significance tested against 2012; Blue significantly lower, Red significantly higher. October 2005 through 2012, n= varies 4,784 5,249. Copyright 2013 Javelin Base: All Consumers. Strategy & Research, a division of Greenwich 2013 Javelin Strategy & Research Associates. All rights reserved. It is protected by copyright and other 10 0%

11 PREVENTION D B : P F The most essen al of tools required to commit iden ty fraud is the iden ty itself. In the past, this informa on was obtained a variety of ways that have included roo ng through vic ms trash, stealing records from their health care provider s office, or manipula ng necessitated by law. These no fica ons are generated by the vic ms through social engineering. Advancement comes to crime, as it does to most things in which a profit can be made, and data breaches have become the means de rigueur for pilfering the trend of the past few years, consumers who were no fied that voluminous amounts of consumer informa on with far less risk than previous methods. The type of PII secured during these breaches lend themselves to commi ng par cular types of fraud, SAMPLE PAGE and criminals are using the breached informa on to do just that consumers. breaches beget fraud. Protec ng against a breach and responding properly in its wake are necessary steps in the ba le against this insidious criminal prac ce. No fying consumers of a breach has become common prac ce in an effort to keep consumers informed, and in some instances as organiza on that suffered the data breach or by the FI associated with the account informa on that was breached. In keeping with they were vic ms of a data breach in 2012 were significantly more likely to be vic ms of fraud than they were in 2011, with a fraud incidence rate of 22.5% (see Figure 27) compared with 5.3% of all Increase in Fraud Rate Among Data Breach Vic ms Outpaces Increase in Overall Fraud Rate Figure 27: Fraud Incidence by Data Breach Vic ms, Non Data Breach Vic ms and All Fraud Vic ms 25% 22.5% 20% 18.9% 15% 10% 5% 0% 4.4% 1.4% 11.8% 4.9% 5.3% 2.4% 2.9% Q2. In the last 12 months, have you been notified by a business or other institution that your personal or financial information has been lost, stolen or compromised in a data breach? All consumers Non data breach victims Data breach victims October , n = varies 337 5,249 Base: All consumers, data breach victims, non data breach victims Javelin Strategy & Research Copyright 2013 Javelin Strategy & Research, a division of Greenwich Associates. All rights reserved. It is protected by copyright and other intellectual property laws. You may display or print the content available for your use only. You may not sell, publish, distribute, re transmit or otherwise provide access to the content of this report. 11

12 The number of mobile malware programs is growing at a rapid pace (see Account Takeover sec on, pg. 32, but consumers have the means to mi gate these threats. The successful malware that takes advantage of weaknesses in mobile device opera ng systems or other apps can be mi gated by installing the latest so ware patches and keeping opera ng systems up to date. Security so ware, which 64% of smartphone owners have displayed a willingness to use, 43 can proac vely stop malware from being installed and eliminate any malware already on the device. When a mobile network data connec on is either unavailable or inconvenient, consumers may choose to use public Wi Fi hotspots as an alterna ve, but not all hotspots are created equal in terms of security. While only 40% of mobile consumers consider such ac vity risky (see Figure 32) public Wi Fi hotspots can provide SAMPLE PAGE fraudsters with a backdoor to transmissions carrying sensi ve consumer data. Airports, hotels, and coffee shops are loca ons that frequently offer Wi Fi hotspots as a convenience. Consumers could mistakenly connect to hotspots that appear to be legi mate as they bear names similar to other business in the same loca on or they have names such as Free Wi Fi but are in fact controlled by fraudsters. Once the consumer s device is connected, any transmi ed data is intercepted and may later be misused to commit iden ty fraud. Such a scenario could be responsible for a fraud incidence rate among public Wi Fi users that is 45% higher than for those who have not used public hotspots. Among technology product owners, tablet owners are most likely to suffer from iden ty fraud compared with all other consumers (see Figure 34), though this is likely a func on of mul ple factors. Tablet Owners More Than 80% More Likely Than All Other Consumers to Become Fraud Vic ms Figure 34: Fraud Incidence by Ownership of Tech Products Fraud incidence rate 15% 14% 13% 12% 11% 10% 9% 8% 7% 6% 5% 4% 3% 2% 1% 0% 5.3% All consumers 5.6% Mobile phone owners 6.0% 6.3% 6.5% Laptop owners Desktop computer owners Smartphone owners 9.6% Tablet owners Q39A: Please indicate which of the following products do you personally own and use. Q5: How long ago did you DISCOVER that your personal or financial information had been misused? October 2012, n = varies 1,062 to 5,249. Base: All consumers, owners of various products Javelin Strategy & Research Copyright 2013 Javelin Strategy & Research, a division of Greenwich Associates. All rights reserved. It is protected by copyright and other intellectual property laws. You may display or print the content available for your use only. You may not sell, publish, distribute, re transmit or otherwise provide access to the content of this report. 12

13 Companies Mentioned Amazon MasterCard American Express McAfee Apple Microsoft Discover PayPal EBay Target Europay Trend Micro Facebook Visa Global Payments Wal Mart Google Zappo s Macy s 13

14 Place Your Order as Follows: 1) Call us at (925) ) us at marke 3) Fax or Mail using the form below: Report Title Publica on Date Price Name: Organiza on: Title: Division or group: Phone: Fax: Address: Signature to confirm your order: Payment Method: [ ] Payment card [ ] Check Enclosed [ ] Invoice me Visa, MC, AE or Disc. card #: Exp date: / Name on Card: Signature: Note: Reports are provided in electronic PDF form only. Javelin reports are subject to standard terms and condi ons, as described on our web site. Javelin will contact you in the future to provide our free research newsle er or other mailings. If you do not wish to receive our newsle er or other mailings, you may advise us of this. Your contact informa on will not be sold to other organiza ons. 14